@SFowler 47089e7 forsyth 
Apologize for any inconvenience this has caused. I have reached out to your support/development team for more guidance. I will update you when I have more information. 

@SFowler 47089e7 forsyth 
I reached out to you privately to gain some more information. Our development team needs some more information. Please email our support team and they can help you further. 

@SFowler 47089e7 forsyth - 
This endpoint will get all the tickets, from there you can filter each item by the AssignedToUser for your API user after you get the specific ones for your user you can then get the IssueId for those tickets from the same object. Unfortunately, our team does not see a Get Open Tickets by User, we only see a Get Closed Tickets by User, which has all of this data for your closed tickets but we assume you need it for open tickets. If you can use the Closed tickets here's that endpoint.

Which endpoint? I have experience writing agains RESTFul API. I have things that work using PaloAlto API, ExtremeNetworks, Microsoft Graph, Google Gsuite and I have usually been able to make some sense out of the documentation, but the IIQ API “documentation” is not exactly clear on what does what. 

Just look at the sample image I posted to this thread. What is the purpose of /global/tickets. I can assume, but some direction would be helpful.

I found additional information here: https://www.reddit.com/r/IncidentIQ/comments/nmgfua/comment/h0y1pat/?utm_source=share&utm_medium=web2x&context=3

I think (not completely convinced yet) based on this this it got from Dev Console using the filter method:POST: 

https://forsyth.incidentiq.com/api/v1.0/tickets?$s=200&$o=TicketPriority DESC

I am getting 200 items returned, now I just need to see if they are what I need when I enumerate the JSON array.

Let me put the quote from from the Reddit post here so it can possible be searched.

“ I've found that often the best way to put together a request is to perform the action you desire to do programmatically within the webapp first & pull the request from the dev console. You can then easily export it as cURL”  REF: https://www.reddit.com/r/IncidentIQ/comments/nmgfua/comment/h0y1pat/?utm_source=share&utm_medium=web2x&context=3

I will upload an image in hopes to save some one else time.

The other option I prefer is just to read the data straight from the devtools.

 

By building the filters in the web portal first I could then analyze the API calls.
 

Using that information I was able to build a JSON payload:
payload = json.dumps({
    'ProductId' : '88df910c-91aa-e711-80c2-0004ffa00010',
    'Schema':'All',
    'OnlyShowDeleted':'false',
    'Filters': {'Facet':'issuecategory',
                'Name':'Provisioning Requests: Resource Calendar',
                'Id':'74194a74-e4e7-021b-a6f9-a3925b72219a','Value':'',
                'Negative':'false',
                'SortOrder':'',
                'Selected':'true',
                'IsUnassigned':'false',
                'GroupIndex':0,
                'FacetName':''},
                {'Facet':'status',
                'Name':'Approved',
                'Id':'85225a5c-dac5-ea11-8b03-0003ffe4d4cc',
                'Value':'',
                'Negative':'false',
                'SortOrder':'',
                'Selected':'true',
                'IsUnassigned':'false',
                'GroupIndex':0}],                
    'FilterByProduct':'true',
    'ShowChildTickets':'true'
})

With that payload I was shown just my two open tickets.

One of the frustrating things is this URL format or details is not obvious in the API documentation.
https://<site>.incidentiq.com/api/v1.0/tickets?$s=200&$o=TicketPriority DESC.  
 

Is this the reference for what I figured out in Devtools?

 

@SFowler 47089e7 forsyth 
Thank you for providing all the screenshots and additional information. I have reached out to our support team for more guidance and will follow up soon 

I realize that this is six months old, but I've also been trying to get open tickets for a user, and I wondered if there was any more information on this, that could be shared. 

@bclark I was reading through the support ticket, and it does not look like you will be able to open tickets via this API call.  Did you try the solution @SFowler 47089e7 forsyth marked at best answer? (You already know I am noooooo API expert ) 

@Hannah Bailey Did I miss something while reading through it? 

Here is a code snippet from the method I wrote.  I have removed our GUIDs.  I can’t share all of it.

 

 $urlRequest = '{0}{1}{2}/tickets/new' -f  $urlProtocol,$urlHostName,$urlApiQueryString
    $Body = @{
    HasSensitiveInformation = 'false'
    IssueDescription = $issueDescription
    LocationId = $locationid
    SourceId = 1
    Subject = 'Other Requests - Compromised Accounts > Admin Confirmed Risky User'
    TicketWizardCategoryId = ''
    AssetCategoryId = ''
    IssueCategoryId = ''
    IssueId = ''
    IssueTypeId = ''
    ProductId = ''
    } | ConvertTo-Json

    if($dictAtRiskUsers){
        $Params = $null #Make sure not existing value
        $Params = @{
            Uri     = $urlRequest
            Method  = 'POST'
            Headers =  $headers
            ContentType = 'application/json'
            Body = $Body
        } 

        try {
            #$Params
            $response = Invoke-RestMethod -UseBasicParsing @Params 
            $ticketNumber = $response.Item.TicketNumber 

            #read-host -Prompt "$ticketNumber"
            
            Start-Sleep -Seconds 5 #It seems we need to wait on IIQ catchup
            updateCustomFields $response.Item.TicketId $atRiskUser.userPrincipalName ""

            Start-Sleep -Seconds 5 #It seems we need to wait on IIQ catchup
            updateCustomFields $response.Item.TicketId $atRiskUser.userPrincipalName $atRiskUser.evidence

            return $ticketNumber
        } catch {
          Write-Host $_ -ForegroundColor Red
        }
    }
    return $false

Thank you @SFowler 47089e7 forsyth. I’ll definitely be going through this today.

I almost forgot you will need to establish the header that will always be sent.

 

$headers = New-Object "System.Collections.Generic.Dictionaryy[String],,String]]"
$headers.Add("Authorization", "Bearer ${bearerCode}")
$headers.Add("SiteID", "")
$headers.Add("UserId", "")
$headers.Add("ProductId", "")
$headers.Add("Content-Type", "application/json")

I did it in powershell.  I have also done it using Python, but that was very early on in trying to figure this API out, so it really only makes sense to me. 

This thread was super helpful. Thank you. Looks like I got what I need. I'm working in bash but I'm able to pull the tickets. Thank you!

Love this collaboration! Thank you @SFowler 47089e7 forsyth for providing all of that information. It went above and beyond my brain. @bclark Glad to hear you got what you need!